njrat | 977565988377bf3f44444095ecb38c87432ce4bae2059da4aa75124ef1c3de15

General

Target

977565988377bf3f44444095ecb38c87432ce4bae2059da4aa75124ef1c3de15.exe
Size

1.4MB
MD5

7692667d5a258ba4cdb84473fb50efdc
SHA1

3102de64a4476befc1684c4595f24ec707472662
SHA256

977565988377bf3f44444095ecb38c87432ce4bae2059da4aa75124ef1c3de15
SHA512

1b365067b03c94bacf8f22b5cc32e7a6b85b6359a215f197e6c4747e956ce409de94a5bc8c543af76e98983516a07d111c35ac66f99f85b3e0b7d6858b2052fb

Score

10^/10

njrat test1 trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

Test1

C2

127.0.0.1:1177

Mutex

6bc405af81ea48ffdc111c35dcd0d4b4

Attributes

reg_key
6bc405af81ea48ffdc111c35dcd0d4b4
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 2 IoCs

Processes:

TempServer.exenimer.exe

pid process

1456 TempServer.exe
1936 nimer.exe
Loads dropped DLL 2 IoCs

Processes:

977565988377bf3f44444095ecb38c87432ce4bae2059da4aa75124ef1c3de15.exeTempServer.exe

pid process

792 977565988377bf3f44444095ecb38c87432ce4bae2059da4aa75124ef1c3de15.exe
1456 TempServer.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1456	TempServer.exe
1936	nimer.exe

pid	process
792	977565988377bf3f44444095ecb38c87432ce4bae2059da4aa75124ef1c3de15.exe
1456	TempServer.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

977565988377bf3f44444095ecb38c87432ce4bae2059da4aa75124ef1c3de15.exeTempServer.exe

description	pid	process	target process
PID 792 wrote to memory of 1456	792	977565988377bf3f44444095ecb38c87432ce4bae2059da4aa75124ef1c3de15.exe	TempServer.exe
PID 792 wrote to memory of 1456	792	977565988377bf3f44444095ecb38c87432ce4bae2059da4aa75124ef1c3de15.exe	TempServer.exe
PID 792 wrote to memory of 1456	792	977565988377bf3f44444095ecb38c87432ce4bae2059da4aa75124ef1c3de15.exe	TempServer.exe
PID 792 wrote to memory of 1456	792	977565988377bf3f44444095ecb38c87432ce4bae2059da4aa75124ef1c3de15.exe	TempServer.exe
PID 1456 wrote to memory of 1936	1456	TempServer.exe	nimer.exe
PID 1456 wrote to memory of 1936	1456	TempServer.exe	nimer.exe
PID 1456 wrote to memory of 1936	1456	TempServer.exe	nimer.exe
PID 1456 wrote to memory of 1936	1456	TempServer.exe	nimer.exe

C:\Users\Admin\AppData\Local\Temp\977565988377bf3f44444095ecb38c87432ce4bae2059da4aa75124ef1c3de15.exe
"C:\Users\Admin\AppData\Local\Temp\977565988377bf3f44444095ecb38c87432ce4bae2059da4aa75124ef1c3de15.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:792

C:\Users\Admin\AppData\Local\TempServer.exe
C:\Users\Admin\AppData\Local\TempServer.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1456

C:\ProgramData\nimer.exe
"C:\ProgramData\nimer.exe"
3⤵
- Executes dropped EXE
PID:1936

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\nimer.exe
MD5
7cbdea2979d0fe2d19b60004bff7007a

SHA1
a1448e8d430d1f4a85e537cabb12adcbaf285020

SHA256
24425c3e4f7eb4fbfdad529e3e07939e3175a2b7f12c8ea10cb4691c687f03d0

SHA512
e2b4b3c22db5f362603bd0e59996e05f33d4f063c48b4cfb06ec05cfcf4034df3e0b4536075b8eb03adce454215850d89cad0b3a9d0e9c0472d9180e90f6e3c5

Download Submit
C:\ProgramData\nimer.exe
MD5
7cbdea2979d0fe2d19b60004bff7007a

SHA1
a1448e8d430d1f4a85e537cabb12adcbaf285020

SHA256
24425c3e4f7eb4fbfdad529e3e07939e3175a2b7f12c8ea10cb4691c687f03d0

SHA512
e2b4b3c22db5f362603bd0e59996e05f33d4f063c48b4cfb06ec05cfcf4034df3e0b4536075b8eb03adce454215850d89cad0b3a9d0e9c0472d9180e90f6e3c5

Download Submit
C:\Users\Admin\AppData\Local\TempServer.exe
MD5
7cbdea2979d0fe2d19b60004bff7007a

SHA1
a1448e8d430d1f4a85e537cabb12adcbaf285020

SHA256
24425c3e4f7eb4fbfdad529e3e07939e3175a2b7f12c8ea10cb4691c687f03d0

SHA512
e2b4b3c22db5f362603bd0e59996e05f33d4f063c48b4cfb06ec05cfcf4034df3e0b4536075b8eb03adce454215850d89cad0b3a9d0e9c0472d9180e90f6e3c5

Download Submit
C:\Users\Admin\AppData\Local\TempServer.exe
MD5
7cbdea2979d0fe2d19b60004bff7007a

SHA1
a1448e8d430d1f4a85e537cabb12adcbaf285020

SHA256
24425c3e4f7eb4fbfdad529e3e07939e3175a2b7f12c8ea10cb4691c687f03d0

SHA512
e2b4b3c22db5f362603bd0e59996e05f33d4f063c48b4cfb06ec05cfcf4034df3e0b4536075b8eb03adce454215850d89cad0b3a9d0e9c0472d9180e90f6e3c5

Download Submit
\ProgramData\nimer.exe
MD5
7cbdea2979d0fe2d19b60004bff7007a

SHA1
a1448e8d430d1f4a85e537cabb12adcbaf285020

SHA256
24425c3e4f7eb4fbfdad529e3e07939e3175a2b7f12c8ea10cb4691c687f03d0

SHA512
e2b4b3c22db5f362603bd0e59996e05f33d4f063c48b4cfb06ec05cfcf4034df3e0b4536075b8eb03adce454215850d89cad0b3a9d0e9c0472d9180e90f6e3c5

Download Submit
\Users\Admin\AppData\Local\TempServer.exe
MD5
7cbdea2979d0fe2d19b60004bff7007a

SHA1
a1448e8d430d1f4a85e537cabb12adcbaf285020

SHA256
24425c3e4f7eb4fbfdad529e3e07939e3175a2b7f12c8ea10cb4691c687f03d0

SHA512
e2b4b3c22db5f362603bd0e59996e05f33d4f063c48b4cfb06ec05cfcf4034df3e0b4536075b8eb03adce454215850d89cad0b3a9d0e9c0472d9180e90f6e3c5

Download Submit
memory/792-60-0x0000000075041000-0x0000000075043000-memory.dmp

Filesize
8KB

Download
memory/1456-62-0x0000000000000000-mapping.dmp

Download
memory/1456-66-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1936-68-0x0000000000000000-mapping.dmp

Download
memory/1936-72-0x0000000001E60000-0x0000000001E61000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing